mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-12 18:06:11 +02:00
nguyenm7andPaperclip
066a4e8019
PAP-18519. The recorded answer to the question both connector skills ask first -- does this vendor need a catalog entry at all -- for the vendor Michael named as the acceptance case. Reproduces Enterpret's public metadata from this runtime (no drift on any stated fact, three additive observations), then exercises Paperclip's client-resolution ladder against a loopback mirror of that metadata, on a disposable self-hosted instance started for the pass and torn down after it. No Enterpret credential exists, none was requested, no client was registered there, no consent given, no tool called. The three questions the ticket asked, answered with executed output: - Discovery resolves completely from the 401 challenge alone, in two metadata fetches. The catalog definition should ship serverUrl only; a hard-coded endpoint pair would become authoritative and skip discovery for good. - The ladder falls through to DCR, but the public-HTTPS condition the playbook names is not what decides it -- this authorization server never advertises a Client ID Metadata Document, so DCR is the only rung on any deployment. Asserted for both callback origins. - Revoke is enforced entirely Paperclip-side. Zero revocation calls were made because there is nothing to call: revocation_endpoint is read nowhere in server/src and has no slot in the persisted oauth config. Scenario 8 cannot read verified for this provider. The catalog-entry recommendation is yes, and the reason is governance rather than connectivity. With no annotations to infer from, all ten documented tools classify as read -- including run_graph_query and execute_cypher_query, which execute operator-supplied queries against the vendor's customer-feedback graph. The wizard shows the operator ten reads and no changes. The nine runbook scenarios are marked per deployment. Every row naming Enterpret itself is not run, for one reason: no authorized credential. Cloud is untested throughout. The mirror server is embedded in the doc rather than added as a script, so the skills package keeps its markdown_only trustLevel. Extracted and booted from the published text to confirm it runs as written. Co-Authored-By: Paperclip <noreply@paperclip.ing>